4

I'm trying to change the SID of various user in Samba 4.1.14 using pdbedit

pdbedit --user <username> SID=<SID>

I run the command but no message is displayed nor the SID is changed.

How can I modify users' SID in Samba 4.1.14?

5
  • I have the same problem, somehow I have two same SID's so I want to change them.
    – Davidenko
    Nov 11, 2015 at 14:39
  • Two users with the same SID? Are you using only one server? My problem, which I left aside for undetermined time, is that I want to change my domain name but avoid creating "new users" on each machine when the users login using the new domain. For example perry.platypus has a SID S-1-5-21-2447931902-1787058256-3961074038-5004 on the old domain but on the new domain he has S-1-5-21-2447931902-1787058256-4461074038-2222, when he logs in in the new domain Windows will create a new user folder perry.platypus.NEWDOMAIN. That's a huge problema for me.
    – msmafra
    Nov 14, 2015 at 13:26
  • I recommend you start using compiled version of samba to keep it updated.
    – msmafra
    Nov 14, 2015 at 16:57
  • I've tested with 4.1.14, 4.1.21, 4.2.1 e 4.3.1 and is not working. They should have removed it since it doesn't work in any version.
    – msmafra
    Nov 15, 2015 at 15:42
  • 1
    it seams that in your case you'll have to choose one user to exclude from the domain and recreate the user. There was, I think it was removed from Sysinternals, a tool called NewSID or something like that. I think you can still find it. NewSID can change the local Windows user SID avoding having to copy all the user's data to the new one.
    – msmafra
    Nov 15, 2015 at 15:46

4 Answers 4

2

Samba 4 domain controllers ignore pdbedit's attempts to set SIDs. To change a user's SID, you'll have to use the ldb-tools package to edit the SAM LDB in the Samba state directory directly. New Samba versions have a private/sam.ldb.d subdirectory containing one LDB file per naming context, e.g. DC=EXAMPLE,DC=COM.ldb; some versions might just have the private/sam.ldb file.

Caution: It is a good idea to back up the Samba domain before tinkering with its state.

Once you've identified the file of interest, stop the Samba service. Invoke ldbedit to edit one record in that LDB specified by the username whose SID needs to be adjusted:

sudo ldbedit -e nano -H /var/lib/samba/private/sam.ldb.d/DC=EXAMPLE,DC=COM.ldb '(samaccountname=someone)'
#               ~~~~                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~                  ~~~~~~~
#          editor of choice                             LDB of interest                        username

Caution: You are responsible for making sure the SID you choose is not also used by an existing or future account.

Adjust the SID on the objectSid line, save the file, and exit the text editor. ldbedit will apply the change and you can restart the Samba service.

2
  • It would be nice for some more people to test it. Nowadays, with the current versions, I don't know if it would really work, and I don't work on the place anymore nor have some server to test it.
    – msmafra
    Jan 2, 2021 at 16:03
  • Yes, it works. For me, /var/lib/samba/private/sam.ldb didn't work, I had to use /var/lib/samba/private/sam.ldb.d/DC*
    – RalfFriedl
    Feb 18 at 10:00
1

Years later... There is no way to do that! For the mentioned versions at the time. I tried!

0

pdbedit --user youruser -U NEWSID

0
0

@msmafra I tested it with Samba 4.11.2 on CentOS 8 and it works.

Also it can be run on a single line without editors, as follows. -e parameter can be use with other commands like sed, cat and etc.

ldbedit -e 'sed -i "s/OLD_SID/NEW_SID/g"' -H /var/lib/samba/private/sam.ldb.d/DC\=EXAMPLE\,DC\=LAB.ldb "(objectSid=OLD_SID)"
1
  • Good idea for batch changes.
    – RalfFriedl
    Feb 18 at 10:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .